PT-2026-69362 · WordPress · Salon Booking System
CVE-2026-17021
·
Published
2026-08-10
·
Updated
2026-08-10
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Salon Booking System WordPress plugin versions prior to 10.30.34
Description
The plugin fails to properly restrict access to certain booking-modification AJAX actions and does not verify the ownership of the targeted booking. This allows unauthenticated users to modify the stored total of arbitrary bookings.
Recommendations
Update the Salon Booking System WordPress plugin to version 10.30.34 or later.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Salon Booking System